Some kinds of receivers can be localized because they convert input frequencies to a standard internal frequency for more convenient processing. See https://en.wikipedia.org/wiki/Superheterodyne_receiver#Local...

It's how the TV detectors work in countries, such as the UK, that charge a license fee for TVs.

Military radios can't use this common technique because of the risk of detection.

I suspect pagers only receive on 1 or at most a few frequencies. If that's correct, they wouldn't need that technique.

It is still way more difficult to localize a local oscillator (especially one that's trying even slightly to shield itself) than something trying to transmit to a tower a few miles away.

We are talking tiny signals here, modern RF frontends don't leak meaningful amounts of RF, otherwise it would knacker batterylife.